Report - gtptnwswrld2.xyz/adult_video_3/1328/2da4af00d834dfbd23fda189a58e00c9/

Report Overview

Visited public
2023-12-10 09:08:42
Tags
URL
gtptnwswrld2.xyz/adult_video_3/1328/2da4af00d834dfbd23fda189a58e00c9/
Finishing URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP / ASN
192.133.142.177
#15317 SERVEREL-AS
Title

Detections

urlquery

Network Intrusion Detection

250

Threat Detection Systems

356

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
gpshtb.com	unknown	2022-11-21	2022-11-21 11:51:33	2023-12-07 14:08:13	531 B	19 kB	173.214.244.181
news-xagedi.cc	unknown	2023-11-13	2023-11-13 15:41:15	2023-12-09 11:54:15	102 kB	5.5 MB	144.76.106.61
rexpush.club	unknown	2023-05-11	2023-05-11 23:18:32	2023-12-09 11:54:10	577 B	37 kB	199.182.164.165
ykrvt.bestssp.top	unknown	2022-12-30	2023-06-02 01:21:39	2023-12-05 15:12:09	558 B	1.0 kB	188.114.96.1
a.coreforger.top	unknown	2023-11-23	2023-12-07 10:02:20	2023-12-09 05:12:21	2.4 kB	143 kB	172.67.170.150
www.gstatic.com	unknown	2008-02-11	2016-07-26 11:37:06	2023-12-09 06:23:49	1.4 kB	32 kB	142.250.74.35
errors.house	unknown	2022-11-10	2022-11-11 11:51:47	2023-12-09 08:30:04	26 kB	126 kB	46.4.134.147
ykrvt.coreforger.top	unknown	unknown	No data	No data	2.6 kB	215 kB	172.67.170.150
cdnstatic.coreforger.top	unknown	2023-11-23	2023-12-07 10:12:06	2023-12-09 05:12:20	1.2 kB	29 kB	172.67.170.150

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-12-10 09:08:17	medium	173.214.244.181	Client IP	ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2023-12-10 09:08:17	medium	Client IP	Internal IP	ET DNS Query to a *.top domain - Likely Hostile
2023-12-10 09:08:18	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:18	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:19	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:20	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:21	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:22	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:23	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:24	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:25	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:26	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:27	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:28	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:29	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:30	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:31	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:32	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:33	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:34	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:35	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:36	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:37	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD
2023-12-10 09:08:38	medium	Client IP	Internal IP	ET DNS Query for .cc TLD

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

Scan Date	Severity	Indicator	Alert
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed
2023-12-10	medium	news-xagedi.cc	Sinkholed

ThreatFox

No alerts detected

JavaScript (1)

	URL	From	Size	First Seen	Last Seen
	news-xagedi.cc/lands/37/jquery-3.2.1.min.js	ScriptElement	86 kB	2023-10-13	2025-05-06
Pretty URL news-xagedi.cc/lands/37/jquery-3.2.1.min.js IP 144.76.106.61 ASN #24940 Hetzner Online GmbH Introduced by scriptElement Embedded in HTML false Observations First Seen2023-10-13 15:45 Last Seen2025-05-06 08:07 Times Seen864 Hash 749cf8b9115d2e483c42a09caba49a47 6071774de33379640cc5bc565bc4f5fc8a73dc8d 4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83 Loading...

HTTP Transactions (248)

URL IP Response Size

ykrvt.bestssp.top/?pl=qRuQunqVKEWrY1jyLTBUOA&sub_id=1328

188.114.96.1

0 B

URL
ykrvt.bestssp.top/?pl=qRuQunqVKEWrY1jyLTBUOA&sub_id=1328
IP
188.114.96.1:0
ASN
#13335 CLOUDFLARENET

File type

Size
0 B (0 bytes)
Hash
d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

HTTP Headers

GET /?pl=qRuQunqVKEWrY1jyLTBUOA&sub_id=1328 HTTP/1.1
Host: ykrvt.bestssp.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gtptnwswrld2.xyz/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
date: Sun, 10 Dec 2023 09:08:17 GMT
content-length: 0
location: https://ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
set-cookie: qRuQunqVKEWrY1jyLTBUOA=19; max-age=345600; path=/; samesite=lax
__pl=b2e9ca52-0e13-4c53-81ec-491b44778689; expires=Wed, 10 Dec 2025 09:08:17 GMT; path=/; samesite=lax
__cap=1; max-age=3600; path=/; samesite=lax
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UiJCz%2B4GIxuahjtMK%2BKiHmOXcGRes%2FSowkmIRqB1I3Rf23UDAMvWGFmz1XTRN4bg9B%2FEeYBlhuP8aigou04YbiTMq9sQfOGF8nryHbipXBUwrhVs%2B7h1SkQXG0xk5v%2FZg8ItZw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833457aacba156ab-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

ykrvt.coreforger.top/ph-new/assets/thumb-big.jpg

172.67.170.150

83 kB

URL
ykrvt.coreforger.top/ph-new/assets/thumb-big.jpg
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1237x691, components 3 - data
Size
83 kB (82623 bytes)
Hash
cb5cedbae6d67e62dc9fde274b7f7dbe
f31d7811c4b6e50ae053f315152366501a8b6002
deaddba93625d2c7610076927fcd37afadad9324ca3210a2bb12784d313dd788

HTTP Headers

GET /ph-new/assets/thumb-big.jpg HTTP/1.1
Host: ykrvt.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: image/jpeg
content-length: 82623
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-142bf"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9dIXceExJZUcGmmwBkgreB%2BGKCdpOO9bnf4jc2buCAnOFwlHd%2F58KZAw5rF2xxrYsfK%2FSSqQxeH6WwIrNNJsMKHL5b2TDWaOrU2IKSVSK9%2FW3GBfg3v%2BhQuh3zf6WX1a1CZDrL5%2F4g%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457acee3f5699-OSL
alt-svc: h3=":443"; ma=86400

ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597

172.67.170.150

16 kB

URL
ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (4233), with CRLF line terminators
Size
16 kB (15720 bytes)
Hash
352bd96e575cb20dfa8013b8649e71f0
8cfa114826620e15ef81535c159ce67f41a98f2a
351d034e0a751b69be6211b65629c5f195deef6735c33a4f8cc701bf0093cc8f

HTTP Headers

GET /ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597 HTTP/1.1
Host: ykrvt.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: text/html
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ArKtQn1qseS7mm3BbYaS%2FZs%2Bus1iObiFk9o62Na5WQFUxCEY7h6icXQ%2FonLvScntt%2BnAMjE%2BWDS1jH2dUjMLcTqT%2Bel%2F9y7FWQt8WeFGY4zmBbj%2F%2F9dXUeEzQbEUqxkttxtGklwVYw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833457acfe435699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

cdnstatic.coreforger.top/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&click_id=&sub_id=1328&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=242402a480b34258a6dd2a3f0f52131d

172.67.170.150

22 kB

URL
cdnstatic.coreforger.top/ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&click_id=&sub_id=1328&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=242402a480b34258a6dd2a3f0f52131d
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
Unicode text, UTF-8 text, with very long lines (31563), with no line terminators
Size
22 kB (22338 bytes)
Hash
8d9424e95f04349565373f0ca75b6648
5033256c1f694fba785804bee99e9f7ca1e42f2d
34ff6ac6dc4a2ec937f83a41807a01810df17944b1c225025c81fa754d0a04ee

HTTP Headers

GET /ps/ps.js?&edg=true&sw=&fullscreen=true&pl=true&pp=false&id=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&click_id=&sub_id=1328&appspot=&d=https%3A%2F%2Fcdnstatic.coreforger.top&timeout=30&tb=true&nrid=242402a480b34258a6dd2a3f0f52131d HTTP/1.1
Host: cdnstatic.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
set-cookie: __psu=3bda3e9d-28e4-49d6-a0a9-c59b5913004a; expires=Wed, 10 Dec 2025 09:08:18 GMT; path=/; secure; samesite=none
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X1IBzHkCN04mboD4kCGHTMaeIaQh7jsvOaNNx9iUUZ6CLp5kLK6TmFSmjvMkjxvtb3rY6xscBeALjovMG3wLA2QmpV3g9bMPu7DxhThm18qDlSPRFhYi5Q16AcU9uYcCIaXsWkwMvn2bQ0Q%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457ae0f145699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js

142.250.74.35

9.9 kB

URL
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (38231)
Size
9.9 kB (9934 bytes)
Hash
0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522

HTTP Headers

GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 05:05:35 GMT
expires: Fri, 06 Dec 2024 05:05:35 GMT
cache-control: public, max-age=31536000
age: 273763
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

a.coreforger.top/ph-new/assets/thumb-big.jpg

172.67.170.150

83 kB

URL
a.coreforger.top/ph-new/assets/thumb-big.jpg
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1237x691, components 3 - data
Size
83 kB (82623 bytes)
Hash
cb5cedbae6d67e62dc9fde274b7f7dbe
f31d7811c4b6e50ae053f315152366501a8b6002
deaddba93625d2c7610076927fcd37afadad9324ca3210a2bb12784d313dd788

HTTP Headers

GET /ph-new/assets/thumb-big.jpg HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: image/jpeg
content-length: 82623
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: "656ef5c1-142bf"
cache-control: max-age=14400
cf-cache-status: HIT
age: 415
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fQJYtfM4MWkYsrAlMQbwbatIx7ot4zfgSY%2BOf6v2itMVBaCRGoJ56sMzlBFdez%2FZMQX1WH%2BdqQxbEUAs7Ho303Vs2GiEpPM8owoJH4m0w410gvem6mtDFnhJnKg1cUned1MD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457b058c85699-OSL
alt-svc: h3=":443"; ma=86400

gpshtb.com/go/709?source=1328

173.214.244.181

19 kB

URL
gpshtb.com/go/709?source=1328
IP
173.214.244.181:0
ASN
#15317 SERVEREL-AS

File type
data
Size
19 kB (18633 bytes)
Hash
c5822801b993b02665e153316884ce2f
e9b2cc182145211d95530f6e9e3efe740bfa0a59
371c497a26f984c623a198e46efbd4984b941721425f603008ec07c7d6e3260f

HTTP Headers

GET /go/709?source=1328 HTTP/1.1
Host: gpshtb.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gtptnwswrld2.xyz/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 302 Found
server: nginx
date: Sun, 10 Dec 2023 09:08:17 GMT
content-type: text/html; charset=UTF-8
location: https://ykrvt.bestssp.top/?pl=qRuQunqVKEWrY1jyLTBUOA&sub_id=1328
X-Firefox-Spdy: h2

www.gstatic.com/firebasejs/10.3.1/firebase-app-compat.js

142.250.74.35

9.3 kB

URL
www.gstatic.com/firebasejs/10.3.1/firebase-app-compat.js
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (28368)
Size
9.3 kB (9308 bytes)
Hash
9900403b65514fad7df39a4e788a6e45
75f9ba061ef4e72bb23528c700f2a11c56d637e9
a202b2051ea9810cd9ba592b3f9418a89e2062f5c185e29e288080b28eb64fe5

HTTP Headers

GET /firebasejs/10.3.1/firebase-app-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9308
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 15:56:06 GMT
expires: Fri, 06 Dec 2024 15:56:06 GMT
cache-control: public, max-age=31536000
last-modified: Thu, 31 Aug 2023 15:20:38 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
age: 234732
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js

142.250.74.35

9.9 kB

URL
www.gstatic.com/firebasejs/10.3.1/firebase-messaging-compat.js
IP
142.250.74.35:0
ASN
#15169 GOOGLE

File type
ASCII text, with very long lines (38231)
Size
9.9 kB (9934 bytes)
Hash
0541b823dfaf39162ef84cf075c9951b
e0934726455558cc1a59823efada9651e33aafaa
21f1d62f222007068c793f0947d98f4ccb7c1595adb68efeb783390fdd8b5522

HTTP Headers

GET /firebasejs/10.3.1/firebase-messaging-compat.js HTTP/1.1
Host: www.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
accept-ranges: bytes
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/firebase-js
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="firebase-js"
report-to: {"group":"firebase-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/firebase-js"}]}
content-length: 9934
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 07 Dec 2023 05:05:35 GMT
expires: Fri, 06 Dec 2024 05:05:35 GMT
cache-control: public, max-age=31536000
age: 273763
last-modified: Thu, 31 Aug 2023 15:20:50 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/images/spinning-circles2.svg

144.76.106.61

503 B

URL
news-xagedi.cc/lands/53/images/spinning-circles2.svg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
SVG Scalable Vector Graphics image - , ASCII text
Size
503 B (503 bytes)
Hash
14e6f9981fa27406176056df2451d27b
aa1b6fd6071391d0031bff2d74ae77347ec2fdb4
466d361db2f130d7e3d40a671c935e3e556c3a49567657afee2e44a0a390a84f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/images/spinning-circles2.svg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/svg+xml
content-length: 503
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1f7"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:19 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

a.coreforger.top/ph-new/assets/trls.js

172.67.170.150

21 kB

URL
a.coreforger.top/ph-new/assets/trls.js
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
Unicode text, UTF-8 text, with very long lines (362), with CRLF line terminators
Size
21 kB (21090 bytes)
Hash
2d452480e0a1246e5ed7e13278b99eee
dc1115b9c20884a07335bdf5abea5c399f5293d6
19b0897b045b6f67abdae0b9f6ca5987202456aa0d7bfc3b17128e94d2cf761d

HTTP Headers

GET /ph-new/assets/trls.js HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: W/"656ef5c1-1e3f"
cache-control: max-age=14400
cf-cache-status: HIT
age: 415
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I3%2B%2Bkq4m%2BrVw9nPUrEbP5E0OMA6A0bJS4KvrwankSdPq3grdcWjgCc3xiO2Lpr0w1aW4HXM7YF8%2FzqU5JfqKbtvwciE6jSGF8a58WJozTWfAgcnEpjm3LQ97ti27pGi0qafX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457b058c25699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/logo.png

144.76.106.61

7.4 kB

URL
news-xagedi.cc/lands/36/img/logo.png
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 180 x 56, 8-bit/color RGBA, non-interlaced - data
Size
7.4 kB (7398 bytes)
Hash
6cd3a78b39a704ee1c84f31c8c4e5808
bb5c81cadfcd60bd5c7b29af2395ef24b11ebb93
4cfbf07b7b4def7ad505f3be44e311c631ffec252a93f031d11356bc1b0c8193

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/logo.png HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/png
content-length: 7398
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1ce6"
accept-ranges: bytes
X-Firefox-Spdy: h2

a.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597

172.67.170.150

32 kB

URL
a.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (4233), with CRLF line terminators
Size
32 kB (32004 bytes)
Hash
352bd96e575cb20dfa8013b8649e71f0
8cfa114826620e15ef81535c159ce67f41a98f2a
351d034e0a751b69be6211b65629c5f195deef6735c33a4f8cc701bf0093cc8f

HTTP Headers

GET /ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597 HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: text/html
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aGwv75eG3dh0gJ9lzT4KZwVb%2FIkPNBxPi7XKAQX12NqboUkKyFBukSAyULrdcfl1sJ2j%2BbYXLFFnIGEVDRUMhwNRLHBOhkC793OkhHqhRr4X16DxNdhkCIOlu5hLQnBj60V2"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833457afe8775699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

news-xagedi.cc/lands/36/img/Spin-1s-80px.gif

144.76.106.61

31 kB

URL
news-xagedi.cc/lands/36/img/Spin-1s-80px.gif
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
GIF image data, version 89a, 80 x 80 - data
Size
31 kB (30677 bytes)
Hash
68556766cd260e97fec2b60a9bfaf8c7
26c969371c9a3de360fab6d7a7a3bec2c5d5c99f
ef50b84645244197917d80f6bcd6f604dce892ec4cdcdc96f11ea40f4a093676

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/Spin-1s-80px.gif HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/gif
content-length: 30677
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-77d5"
accept-ranges: bytes
X-Firefox-Spdy: h2

a.coreforger.top/ph-new/assets/style.css

172.67.170.150

5.0 kB

URL
a.coreforger.top/ph-new/assets/style.css
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with CRLF line terminators
Size
5.0 kB (5032 bytes)
Hash
807d696b86114245f8eda3dce43f61ff
6d65ffaf8ec2107db8f1d29c410f152a8b809a56
7524af6d5f36df3e5d5c8148bc63e3956de050fa262fc0589e2a58dc606977bc

HTTP Headers

GET /ph-new/assets/style.css HTTP/1.1
Host: a.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://a.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: text/css
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: W/"656ef5c1-5f33"
cache-control: max-age=14400
cf-cache-status: HIT
age: 415
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XwMXNZs9tYRywAN2VyLRozXkpecc1OuDmkf2xkRohvntqJ9hlsmkc%2FjntD3ZM5nfGBOxnxCS2y5j98OCTWaTC%2F%2FaO3SgCQbuey5HNsAgD7BU02Ap9pWxZ87hLehih7xizpPO"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457b058c45699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

news-xagedi.cc/lands/36/img/player-controls-r.png

144.76.106.61

408 B

URL
news-xagedi.cc/lands/36/img/player-controls-r.png
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
PNG image data, 60 x 60, 8-bit gray+alpha, non-interlaced - data
Size
408 B (408 bytes)
Hash
f0e42db89f7d0994b3723b35eb05a49f
b4e08e7b2c525345d86dc2299663915c84a41b2b
13bbdf214a22994e4e0e655c256ab493cc495f15f9c1f08772cad0761625a9be

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/player-controls-r.png HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/png
content-length: 408
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-198"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/player-bg.jpg

144.76.106.61

11 kB

URL
news-xagedi.cc/lands/36/img/player-bg.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
11 kB (11291 bytes)
Hash
d0c6f02d6933f0b93db0942e3e7f3609
bc96b3878d13d0f46aa464e94515f27ad53531b0
7296089ccd9e42b305c5b0398d47a78f900b40225c592c6f1ef23ade5bbe667a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/player-bg.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 11291
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2c1b"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-1.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-1.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9604 bytes)
Hash
8374be5c573da988b4d76c1051f8cbc7
c319af79d391edeac2268173798952dd71f0ecf2
41889b3a66aec88fc8a474f19a6c2f6933200524597ccf76f2c9f995687099ea

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-1.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9604
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2584"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-2.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-2.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9474 bytes)
Hash
b1444ede1cb63c55f07c4b7cc861ec58
504823696a6990f0c6892721e34a7496cfe4e704
628146e090737199d0b92e0d069cdc8fa95d65391a7e84b7da053dbc0275b2f8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-2.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9474
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2502"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-3.jpg

144.76.106.61

9.4 kB

URL
news-xagedi.cc/lands/36/img/pics-3.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.4 kB (9413 bytes)
Hash
76025b7cd7b3e168342e9f6916d8c7f4
bd2a6ea7c9105935c7a616fec2d6d85dbf98bfc2
46eaa0e5c25c663d858a5c65629f960ed17d2fe30b2484f629158e6d6460d775

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-3.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9413
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-24c5"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-4.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-4.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9468 bytes)
Hash
107bdcec0a201d69db378827b68127cd
efc977edd0a369769d5f32d88e9858302bed1e5e
cb8a23effd64618021ebe40be5ed24bfb27c17f6d0a82c87a96d9efd91e06468

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-4.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9468
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-24fc"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-5.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-5.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9557 bytes)
Hash
628b98b82d0aca1c1b2155aa5ec51a6a
db663b2b85cf8828f3e9c5aa879325bb50e684a0
d7dfe6be5b49bee8bbf743bc58d74af3dc7d0250c89bd6dd7e9ad268c287289d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-5.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9557
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2555"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-6.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-6.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9620 bytes)
Hash
a83d5196e71bd6f9c55ef3e7322e527c
9dbddad413391599552c4d9cc5c9e8a287ef910f
52212d360cbbf493678d8e8bf75c20b7ad4b1d6cf86bf03e1c87fb5b4d6cb818

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-6.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9620
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2594"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-7.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-7.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9484 bytes)
Hash
94edfad63e95c79618692b8d8dc20587
f582b7b70443ea1fff184ade49ab560fc8fd3318
0940f729e51d0fb610affca787415657f39a630cc0450d08576f69fd0f71756e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-7.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9484
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-250c"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-8.jpg

144.76.106.61

9.8 kB

URL
news-xagedi.cc/lands/36/img/pics-8.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.8 kB (9750 bytes)
Hash
2e7eafc3878ee465f96bca0f9d1e1712
c4f353f12542db5d2df3be74dbae890e0430ac6e
df67f968a051026a5c43eb3e40b8d02a0c72bc742055526fef7e2655dd837cc1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-8.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9750
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2616"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-9.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-9.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9646 bytes)
Hash
c3af10d166a4447c21f25e4a32383a5d
37a0342d08d6933b3bbfd4063b7ba998c991dd73
963fbe86dc33b1a1ba5c695bf9b74ebde439bc7a9260137121d747cf4cfbdd73

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-9.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9646
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-25ae"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-10.jpg

144.76.106.61

9.7 kB

URL
news-xagedi.cc/lands/36/img/pics-10.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.7 kB (9681 bytes)
Hash
00ad8eccd280144f038e883859beeabe
e13583bbe25712e827b8b22b1353c883531f849f
21397b18bd87b564f70404ea1ff41d8d23ba804ed6eea4de323ac1c94e096ada

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-10.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9681
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-25d1"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-11.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-11.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9483 bytes)
Hash
8611f67b36ff57eaa1060e793b9e6ad4
49f273a5760e7375adb1efc58f0ed2c665da6ae8
de70c6d29629dd9ec1b85e3146390c1019bd608eeb3d7ffdc196627f70ee30b2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-11.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9483
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-250b"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-12.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-12.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9487 bytes)
Hash
3971b0cd6849aef8e63c281fe7e53c57
690281f0f9a05a32be18029632240693f7b26270
20a9e9a79f97878e87f805b977eb6046480b734dfd9e90df9f34b22ef484777a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-12.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9487
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-250f"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-13.jpg

144.76.106.61

9.4 kB

URL
news-xagedi.cc/lands/36/img/pics-13.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.4 kB (9378 bytes)
Hash
cd911694d58b5fb86c94cf7a1d5b530b
f32925a79b755d76fdf1ae56fa898ef23d816699
5a8f5f99cb386403813964a7ee271660131e9c50eb5267f932a67ce0f4fb2ea2

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-13.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9378
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-24a2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-14.jpg

144.76.106.61

9.5 kB

URL
news-xagedi.cc/lands/36/img/pics-14.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.5 kB (9498 bytes)
Hash
4957499f251b620472eb5fe6fd126c22
a237ac15f4b16256f1c49a40ca07ca168dea540c
de5d64cc00dd3bc0e0998e274f41bb78de69cae402e53c4f41c0ab8e0af2cd0b

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-14.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9498
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-251a"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-15.jpg

144.76.106.61

9.7 kB

URL
news-xagedi.cc/lands/36/img/pics-15.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.7 kB (9673 bytes)
Hash
bf608c2d10293273951a88b8d38de015
15b2a17c7300725aacc27f320480dfe5bf173a00
118f446f628921fb7cab1afeac932ef77d63a7c5a31ffa288427d80c4de69f9f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-15.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9673
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-25c9"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-16.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-16.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9570 bytes)
Hash
700dfe65fca751e5c160aa1ed38c0389
61a7a9ba2a5209bb28b6a36c4b7ba9088f4b2886
8f8c3d5f93cc6dc00172cf203f6b0113819e853de45518cbcee1e68f9e95fbc1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-16.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9570
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2562"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-17.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-17.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9595 bytes)
Hash
3617c828a4589dfd2af8f90e31f92666
0e7a1dbe743c9eaad109659f7b21ab86719b9cd0
f3ab898058b0ebaba11001b5a2b3c5b5db2d7f766000d95abdbfb841fcb16c1f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-17.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9595
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-257b"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/pics-18.jpg

144.76.106.61

9.6 kB

URL
news-xagedi.cc/lands/36/img/pics-18.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data - data
Size
9.6 kB (9645 bytes)
Hash
52ada45615791fefe3513b98a28d6c61
334b68a65108b2274dc0d41bbed58d10cbfb41a0
204715e71db20e5daffe8494816412e0998ec0b97b303f16fb4102226c492fa4

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/pics-18.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 9645
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-25ad"
accept-ranges: bytes
X-Firefox-Spdy: h2

rexpush.club/js/s_f85e207b23b1d9ae2096bbb1cdca5ac0.min.js?tag=1328&attempt=0&rnd=590583658&lnd=adult_video_3&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=&sub1=&sub2=&sub3=&tb=&t_rdr=

199.182.164.165

37 kB

URL
rexpush.club/js/s_f85e207b23b1d9ae2096bbb1cdca5ac0.min.js?tag=1328&attempt=0&rnd=590583658&lnd=adult_video_3&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=&sub1=&sub2=&sub3=&tb=&t_rdr=
IP
199.182.164.165:0
ASN
#15317 SERVEREL-AS

File type
gzip compressed data, max speed, from Unix - data
Size
37 kB (36655 bytes)
Hash
c415bd02ac005803677086812ca1fcd7
f24c5bfbf5d1085bee5f41ef600b51d32e9496b0
b7f4fe5e24380790b9ea93c154c0b4e3e6bdc132f1b7d832cba9dbaea6bb2364

HTTP Headers

GET /js/s_f85e207b23b1d9ae2096bbb1cdca5ac0.min.js?tag=1328&attempt=0&rnd=590583658&lnd=adult_video_3&v=2&token=2da4af00d834dfbd23fda189a58e00c9&click_id=&sub1=&sub2=&sub3=&tb=&t_rdr= HTTP/1.1
Host: rexpush.club
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://gtptnwswrld2.xyz/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:16 GMT
content-type: text/javascript;charset=UTF-8
set-cookie: _f_30d9ff6106b5fe28d448dd5186c64932=1; expires=Wed, 07-Dec-2033 09:08:16 GMT; Max-Age=315360000; path=/; domain=.rexpush.club; secure; SameSite=None
content-encoding: gzip
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/63/images/thumb-big.jpg

144.76.106.61

83 kB

URL
news-xagedi.cc/lands/63/images/thumb-big.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1237x691, components 3 - data
Size
83 kB (82623 bytes)
Hash
cb5cedbae6d67e62dc9fde274b7f7dbe
f31d7811c4b6e50ae053f315152366501a8b6002
deaddba93625d2c7610076927fcd37afadad9324ca3210a2bb12784d313dd788

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/63/images/thumb-big.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 82623
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-142bf"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/63/images/male.jpg

144.76.106.61

728 B

URL
news-xagedi.cc/lands/63/images/male.jpg
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 60x60, components 3 - data
Size
728 B (728 bytes)
Hash
11887dd0a5df5563fc133e173f0fd484
56c828481f045e04ad0543cecfe06bbb25b41655
9233233438671b5836951cd8d3d8cef0dff3a26fd6693ea22ec92cb67c5c32de

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/63/images/male.jpg HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/jpeg
content-length: 728
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d8"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:20 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:20 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:20 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/53/images/video.gif

144.76.106.61

338 kB

URL
news-xagedi.cc/lands/53/images/video.gif
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
GIF image data, version 89a, 320 x 180 - data
Size
338 kB (337665 bytes)
Hash
fcf0b18683c8cdc51253dc1a577f31c5
436a96bea4f2c714ca6cedff740a2ec5c78516f7
ff02652f62da493983c57d0577df9dda3587232184ea5acd714d1cf83550ae2f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/images/video.gif HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: image/gif
content-length: 500082
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-7a172"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/images/video.gif

144.76.106.61

500 kB

URL
news-xagedi.cc/lands/53/images/video.gif
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
GIF image data, version 89a, 320 x 180 - data
Size
500 kB (500082 bytes)
Hash
2e59da03066a7854825901e0c1460b52
8d5aa04f252de7a85b8387051c1321338ac32d32
63412ff22ec2f712d6e82d34889a0a48948523dedd0bfce03bba69a19a9b4433

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/images/video.gif HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: image/gif
content-length: 500082
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-7a172"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:20 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:21 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:21 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:21 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:21 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:22 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:22 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:22 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:22 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:23 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

57 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (55053)
Size
57 kB (57104 bytes)
Hash
5090b3a554e96a25474c5b4b2c3d43f6
a997dfc14833d74b9f9498123b103538164e5d4e
4ef0f22d0c2f38b479914ba0d9237e4eadfce14087413f4e5233505575699557

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:22 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:23 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:23 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:23 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

11 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (9539)
Size
11 kB (11332 bytes)
Hash
9657612fbb50de9ff3c1840a32d06f4e
02eb06f3ed32ba71d643be7ef2a3086c97165496
a22312d6374f88a698137276bcf2242ade36da8d660a5fdba1209dd99e288a5c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:23 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

28 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (26422)
Size
28 kB (28308 bytes)
Hash
67695a86bfed996b714adee3d7d4449d
aea38c6840bcd6a7142a6ef075e08f773f3f7942
893a2bb53c096311e8ce8ab2ee984a67b51be9da88281d8525fac217ba5c4a43

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:22 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:22 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

46 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (42369)
Size
46 kB (45551 bytes)
Hash
62696aa0aa2a139658257febd457a884
9bf13210b2f650ef30f80579f7fc5620813d8949
8a99935d1330b4cec7259ad29bd95c955e66ad29b805f67538a42f1f11c8a494

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:21 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/48/preloader-43.5794040.gif

144.76.106.61

7.0 kB

URL
news-xagedi.cc/lands/48/preloader-43.5794040.gif
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
GIF image data, version 89a, 160 x 160 - data
Size
7.0 kB (7010 bytes)
Hash
5794040ee88def220320edd0ed2e2ac9
7ec6d7843172d2bec7c0ed0d7eabed19a800fd7b
c1a4896adebc502e9be1248a28bc641ef9a5b75c6bdefa5d704a220c128ee34e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/48/preloader-43.5794040.gif HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: image/gif
content-length: 7010
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1b62"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:24 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:24 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:25 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597

172.67.170.150

95 kB

URL
ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (4233), with CRLF line terminators
Size
95 kB (95028 bytes)
Hash
352bd96e575cb20dfa8013b8649e71f0
8cfa114826620e15ef81535c159ce67f41a98f2a
351d034e0a751b69be6211b65629c5f195deef6735c33a4f8cc701bf0093cc8f

HTTP Headers

GET /ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597 HTTP/1.1
Host: ykrvt.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://gtptnwswrld2.xyz/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 10 Dec 2023 09:08:17 GMT
content-type: text/html
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9USC1trr%2BL%2FB9JWd3frjBeO5X7iN5XzKlHoGXaFU%2BxGkHIb9AJqdVzXhz0%2FZekqLes%2B6e595xSKJOJS7%2Bv7g2OM7QTdn3XZkS7aSmDnWxHK4N4Dt1ifArNNsESP5M0I%2BMgLzhsO%2FNQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 833457ab8e20b50b-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:25 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

96 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
96 kB (96190 bytes)
Hash
c2d8b8c48b44bf223d0da814aea301a3
f9aa06e31ac31ddb968df93fad1aaf81335ea9a9
978daac788cc9d3f9edab9fdc64deea6ebcd6b42dd29d1ed39fe95dbb2207337

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:20 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

100 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (53320)
Size
100 kB (100324 bytes)
Hash
8458d2a6f6fdd2dc7a21445b9213578d
c1ebfa07f42d7d258e84258a41115c94c9ceb9c0
5486dda0d7b24ea48680b072391e75e5e5e06d44f83c8b76449b237eafd57c6a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:19 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:25 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:25 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:26 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:26 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:26 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

18 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (15233)
Size
18 kB (18462 bytes)
Hash
733b6241c2969409fbbb0d295c41302b
4f2ce8e42955a86baf36bdc38fce3ef6653fc2a1
1c37ee9ab6ffb2031ce628a11f419c4545254dcae2837c79c919a8c1d5c13cdf

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:19 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:19 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:27 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

63 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (59622)
Size
63 kB (62944 bytes)
Hash
ee94f51e6465145343d1ae1b9496d236
f3ec75666d6e3872107a5a89ec953b2b12996c25
4ff9bad88fc9984856a73a8be902a48726e59d72936c569624349cf858ca9852

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:27 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:27 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

46 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (42369)
Size
46 kB (45551 bytes)
Hash
f7f9ce46c7a80dfe8eaf1a8f0c82f416
57c7b9a9e17ca397718b24100acd09607e0916cb
6e84bc61a89a6e1c8becba60d22bf53a84e4b850396df60141df4fcffc2241a1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:27 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

16 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (13782)
Size
16 kB (15538 bytes)
Hash
b522d63f66e226105ee0920f8dc063dd
532c7e35cb9a13c26d1437ff54070d0fe2438d0f
b9b1b2303247465f9199d347eb95b594e3da90bd605d2fe22e5b9dcb86a50186

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:23 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:28 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:28 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

57 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (55053)
Size
57 kB (57104 bytes)
Hash
e0f312c10c935575abf4a1105e4d6b93
5e33bf91774a81afc2facecc5c123ff2361bc98d
ac5419c68547b299dd7609c42df25cf3552a9025a082ba58cddfc1a81e8a89cd

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:28 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:28 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

96 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
96 kB (96190 bytes)
Hash
bf83252492db0b198181b275e44ed5c4
1e8e55d71c1103d70f7f816a6020ad336a1dc404
0739e586d821dcc3fc9c08b23016a55777768ffa077f993a2a84fb2ac8a3e44f

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:25 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

18 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (15233)
Size
18 kB (18462 bytes)
Hash
8d604fb81a3eea34627ce5bfa5d2af25
61ab494e6e6d58040539fc92dec4723441ea229f
706ac066ff21b4d9ce03518c68e2667d11a570e39542fda01e2d58830894fb3e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:21 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:29 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:29 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:29 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:29 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:30 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:30 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:30 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:30 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

80 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
80 kB (79868 bytes)
Hash
f4c1dbc2b0f340e2aee7618eadbc8a46
84f5636074c49a87cf0a79dc2d5f35b8ae378a86
13dacf54fb34b29b0d5bead2fc0480af25cf1e8572db16aa746cb786eb227db3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:30 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:30 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

84 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (42435)
Size
84 kB (84478 bytes)
Hash
dc0b7bf44007b7bf8c7ebea4f3d24429
f126c2b9f5c651977d7a75d4b708be78e079633c
221e1b3f089c0a2ff93092ee87d041f06e0646223d4ab89d2956f9059d09ba4e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:27 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:31 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

62 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (59969)
Size
62 kB (61873 bytes)
Hash
58db2d3ab353f4ddb51355b08f9f661a
b6da7335a4962021372ba0024828a6ad12771587
1f6b45c9a81a94d5247eebebe26b5a56acb8569622777c4ea3cba1455ef37fee

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:21 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:21 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

46 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (42369)
Size
46 kB (45551 bytes)
Hash
ad41d3060551de215375be8e8102fc1d
e75fa48c34905c4842a348434ad10991200208a8
666896fbbedbe0cff6952747337e33a3141ae76034831c2bff06bb1223d6f2f0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:27 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

ykrvt.coreforger.top/shared-js/assets/static-pl.js?v=2

172.67.170.150

19 kB

URL
ykrvt.coreforger.top/shared-js/assets/static-pl.js?v=2
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with CRLF line terminators
Size
19 kB (19390 bytes)
Hash
7224243dd0b18bb2508a1d77d4b2a0b2
bd833c24aa241861316053fd8bd46a1bef3d343f
920aa94a10634fc23234b5e4f55c428f6311fc7811d3591792381678cb492659

HTTP Headers

GET /shared-js/assets/static-pl.js?v=2 HTTP/1.1
Host: ykrvt.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/ph-new/?pl=qRuQunqVKEWrY1jyLTBUOA&sm=ph-new&sub_id=1328&nrid=242402a480b34258a6dd2a3f0f52131d&hash=m9n5CHBqIdceh3QNdtnOCA&exp=1702199597
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: application/javascript
last-modified: Tue, 05 Dec 2023 10:04:49 GMT
etag: W/"656ef5c1-dee"
cache-control: max-age=14400
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4w9CtI%2FrBH29inGTDo5by%2BTQyQ%2BVpj0S4hL16Vn%2BstpcT6VXaEc1RKHUnFsXG94qzhdnjWFKZmp1Fvf8nKKUEmWjoT3GZdU2%2BJn7f2muwm5POY25UIxEDUQi481HYXB0EyLXA30EdA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457acfe445699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:32 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/37/jquery-3.2.1.min.js

144.76.106.61

86 kB

URL
news-xagedi.cc/lands/37/jquery-3.2.1.min.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (65460)
Size
86 kB (86537 bytes)
Hash
749cf8b9115d2e483c42a09caba49a47
6071774de33379640cc5bc565bc4f5fc8a73dc8d
4c6c48643cdfc617725f69f7c826b4e87983947a709b36f1e8016ad818bb6d83

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/37/jquery-3.2.1.min.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:32 GMT
content-type: application/javascript; charset=utf-8
content-length: 86537
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-15209"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:32 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:32 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

79 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (63492)
Size
79 kB (79266 bytes)
Hash
bc9660df95850589c5146c381128baf9
edc72fac5329db5e3c366ea30d87e2b595e2ec7e
453ed020d05cd7a8c8177384c44d7558f1d629822d5557137a8c6c27e5b5df20

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:24 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:24 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:32 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

35 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (32833)
Size
35 kB (34784 bytes)
Hash
009ffca3493873eff66563514fcd6f9d
9fb767923c42f303235611da11007c1c8b742aff
d82339d7bd76eb789b435ea60b958209a820e9ec3bed66517ca07383de1bac5e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:25 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:25 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

12 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (9366)
Size
12 kB (12465 bytes)
Hash
e0c8d16f5c7892d5a52d7fbb5c6b6ab9
d61a27bd950af1d425aa62529dc9349914c7f472
b9ced6d0aba006f3805efb2f07f294a9b98ad799f32dfce59311d4b5203cd4ce

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:31 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:32 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

63 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (59622)
Size
63 kB (62944 bytes)
Hash
4f8a3c62a8c98397c8a77c3f9ddd51ff
ef859a4ad37892cecb0cf176fea9b944315d5d9a
a14687cc976e171f2fbac9184f7ae82a466d2a3b2117d3f00576c9be5b66da2a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:32 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:32 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

29 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (26966)
Size
29 kB (28787 bytes)
Hash
f5b2df807f247bccdf28bd7b75808964
5a3615961d90f7d6eac5249365447fabaf954e4d
c8c9d180e6b7f203fddb1f9fda260096792d9c5e831526f610a5e4ae6db934c3

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:31 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:31 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:33 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

35 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (32833)
Size
35 kB (34784 bytes)
Hash
014103d36ebbbc4bad4830c64af64995
b3e2711b9bfcb7c8a1c950b1929d83e38a882c1b
aa9413370e2993068e275f15a79ee95717de40146b73de8e9a56a0e8da1ca055

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:20 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

80 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
80 kB (79868 bytes)
Hash
3113da752b2ffbd6c5af668fb97149c6
47dfd397959f9e93a34cf0a2a9b7c3a605a84bde
59374dd0fa2474ffbe5e653686dee3d1c087f3485a8b718eada3a32d380713d5

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:26 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:33 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

12 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (9366)
Size
12 kB (12465 bytes)
Hash
a6104b45808f9f046181309d88d1b788
ca9a7deba01505cba8e7436071f81dac5309f6f4
efd7a6ee10ddb04daba0ffa4df216cd70d0dff1929b5dccdbe15f2738b5bd051

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:33 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

130 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (41930)
Size
130 kB (130233 bytes)
Hash
48443cf3da0a4a8af1f43830f00aff0b
0beeb79dc5b5d2037e828618ecc9e6d23f653729
b0d9ae74512cb0a9d3a8802c10faddd819cf074f05e15368959db6f8b6f5ce14

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:20 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:20 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:34 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

130 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (41930)
Size
130 kB (130233 bytes)
Hash
ab613d6f3b75732d44e82a9e0f7060b5
e7e85e596844ed3da5fed591e44e9b7045fb1faa
78800a87ae13437695e07a2adb03dccf48ef352a258872be4e82be81aead6adf

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:34 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:34 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:34 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/lands/36/lp.js

144.76.106.61

722 B

URL
news-xagedi.cc/lands/36/lp.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (685), with no line terminators
Size
722 B (722 bytes)
Hash
8061571ac71b47c9ef862658f7e3e81c
c8109eda3ac59808f2e331aa52883ef72526833d
0437c5e6e3fb2533b3166485bb94ad975513518f741a5a7e2d74aeb0ddaa0875

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/lp.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 722
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2d2"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/36/img/style.css

144.76.106.61

12 kB

URL
news-xagedi.cc/lands/36/img/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (11701), with no line terminators
Size
12 kB (11701 bytes)
Hash
ceafd56cc56028ed6235ce4c4db73d43
c0d374219bfbd71aebf2caa38494d48838d4cce0
8878692d5f9a94657f598a59e11fde8703ff41c6ee99d378acc5b22bec49cbd7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/36/img/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: text/css
content-length: 11701
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-2db5"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:35 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:35 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:35 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:35 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:35 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:35 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:36 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

80 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
80 kB (79868 bytes)
Hash
9cfca644f888ccc0f488b1751c750f08
ca2110b3e0e5a50408fafa4c4a1a4169383b20cd
caf40fa9f29fa09e433faa57852cdced21400530f4b7516bc4ce739d12fdc48c

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:36 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

18 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (15233)
Size
18 kB (18462 bytes)
Hash
1568a186961273644ad1492b715da96c
acede2d9a599798189d7233e7d88d08b1879b651
e608e0896eb0cddb7794bbe0423de72d4a52350772ba903716178b7800a6a3a7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:36 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

96 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
96 kB (96190 bytes)
Hash
95632db34ad9900c9cc055ca5af63a41
2c9f1fa775188a8ae2032b88ba45a491aec8de7f
f4cfec8413fa9f9467204d431a7444b74273e0f9f3c0a52d7a7a1e8735051ac7

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:23 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:23 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

46 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (42369)
Size
46 kB (45551 bytes)
Hash
2d93d308eebc209129d7c04a0f894276
d8543b1810734ca56c06272d3cabdc50ac22ad0b
1e80ac8ee0ada812b9f7dd1a121e13d5e7babfffd1ff88b04f75d3747823dac0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:28 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:28 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:36 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

cdnstatic.coreforger.top/ps/config.js?id=qRuQunqVKEWrY1jyLTBUOA

172.67.170.150

5.2 kB

URL
cdnstatic.coreforger.top/ps/config.js?id=qRuQunqVKEWrY1jyLTBUOA
IP
172.67.170.150:0
ASN
#13335 CLOUDFLARENET

File type
ASCII text, with CRLF line terminators
Size
5.2 kB (5160 bytes)
Hash
512755a6a34075b4a23c875b7ae24013
f8cecb3663d1d20fcf19a10af2a47d8238636ed3
d9cc92407823fafcd54c6e83fb6b9a51fbf3a4d9c73b2f4da64243d24ce2f81a

HTTP Headers

GET /ps/config.js?id=qRuQunqVKEWrY1jyLTBUOA HTTP/1.1
Host: cdnstatic.coreforger.top
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://ykrvt.coreforger.top/
Cookie: __psu=3bda3e9d-28e4-49d6-a0a9-c59b5913004a
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/3 200 OK
date: Sun, 10 Dec 2023 09:08:18 GMT
content-type: application/javascript
cache-control: max-age=0, no-cache, no-store, must-revalidate
cf-cache-status: BYPASS
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8iHUWriI8EsCcO%2BcUk8bWjTVTnhdaR0hH71QMSvOKYJSET1MTFOH4dHvoiEaYSCul5z2dxK6vc%2B2DLD8laMRs7w%2Bpvxz2AU1AvN6UYbeLi3PtsUtwCKbnZH2pcQocpQrCzMcG3mqtdU95z4%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 833457aeaf8a5699-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

64 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (62399)
Size
64 kB (64378 bytes)
Hash
f0c0280050a9896217b2e05235b0373b
b1dae6ae1e3681742049659dccf488560ec1ebdc
2ac54864fd16215a8fc7b41d91f85a208a03606267409e5768d9bdcf85b91935

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:33 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

63 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (59622)
Size
63 kB (62944 bytes)
Hash
217fb624256fd75bca326ea20be03175
6f2c11025b969d1280b7698a96ad6fca467a57fe
a2b613f698b369d6294ea861cbe5798d552f794fd5e6606f1b132327a7869667

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:33 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

41 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (37453)
Size
41 kB (40782 bytes)
Hash
13bfa82d32cd23e6c74751d3d0448746
471abc056f57882f2c2d217234c74609467bba15
f316f47ccf69a612c996f1261d7ec4be52ee0ad6e9c906b9e2b8f30b3cf6490a

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:37 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

47 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (45146)
Size
47 kB (46985 bytes)
Hash
9103e3a2595db60244c5eb22914537b4
2f43fe8bfbc76ab029f2723c27b12faaa61aa682
f0a6c39962b76cca3eec6fb4fccf3785d3d9e36e1b8a9360dd7ee2c5441eba14

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:32 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:32 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

12 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (9366)
Size
12 kB (12465 bytes)
Hash
8f54ab96d395ebb2567ab9f42209233d
70ccadeb6211144eaaab2a58ca7480c0305fc473
e30288ab499e2be7bec18f79d73fa7d45175edd0019ffb085024f086c2401bf0

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:26 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:26 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:37 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjQ4LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:37 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:38 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

45 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (26966)
Size
45 kB (45394 bytes)
Hash
b685160475b7a0c53f3769e3c5139681
3107e8d36f7dea5b3403387a45e0c6c384307717
39888c95fe8c6ae542aa564256d85760fd4107a1be18253bf12ff40b03cdc94d

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:33 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:33 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

18 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (15233)
Size
18 kB (18462 bytes)
Hash
172cb3fc92598ec92e4f51e314bb51e7
c533ec34e8f4b2891908c661b7c56c9e701a3a57
a982861e8dc34d95731d5709b88493e012d91660930d3ff94c4201fa9ec1f2c8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:27 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:27 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

97 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (54850)
Size
97 kB (97147 bytes)
Hash
2dd57f6581e2f60bdce2a0d04a7d5d11
5749482624a338133089ee342ee945d2432b0927
7e7e3096c4f12056e69a25ecabf3a50ac474e67037cc5b602ac6fbc0716a29d8

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjYzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:38 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM2LCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:38 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/revopush.js

144.76.106.61

18 kB

URL
news-xagedi.cc/revopush.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
Unicode text, UTF-8 text, with very long lines (18112), with no line terminators
Size
18 kB (18177 bytes)
Hash
773d5dd04e1cf97341ac6e4cf2b23707
a56ebf246900b619f34bdfa36ea0f4a36d800730
a35876c74a7686acc90ac9e198313f89062cf1e0e22cac557b623c92f69f19d1

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /revopush.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:38 GMT
content-type: application/javascript; charset=utf-8
content-length: 18177
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-4701"
accept-ranges: bytes
X-Firefox-Spdy: h2

errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js

46.4.134.147

1.9 kB

URL GET
errors.house/js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js
IP
46.4.134.147:0
ASN
#24940 Hetzner Online GmbH

Requested by
https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Certificate
IssuerLet's Encrypt
Subjecterrors.house
Fingerprint6E:A8:D4:55:8F:2E:C5:D4:D9:36:D0:EE:C3:08:F2:DB:DA:F9:60:85
ValidityWed, 08 Nov 2023 07:32:08 GMT - Tue, 06 Feb 2024 07:32:07 GMT

File type
ASCII text, with very long lines (512)
Size
1.9 kB (1855 bytes)
Hash
cecbd15c62682460fc296825e598657c
7ea3ec61b65e0a88058e3943327a61d055ef4284
58664ef4f18d3763e07cf7c74738b3a1089fc115331ce34bfe300be3e125b510

HTTP Headers

GET /js-sdk-loader/c682bf15f58a4ecea9ff491233690e22.min.js HTTP/1.1
Host: errors.house
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://news-xagedi.cc
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Server: nginx/1.23.1
Date: Sun, 10 Dec 2023 09:08:38 GMT
Content-Type: text/javascript
Content-Length: 1855
Connection: close
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
Surrogate-Key: project/7 sdk/7.15.0 sdk-loader
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

35 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, Unicode text, UTF-8 text, with very long lines (32833)
Size
35 kB (34784 bytes)
Hash
f0c81bc401ec2512d1fe6052fd261ad0
4082578dcdd562ca36f4fcffd5f09dd7f485ee7e
7572f50b033a39b24080bd5b92c16efc4442a6b569f671e17ecee29451be4848

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:38 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:38 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/css/style.css

144.76.106.61

4.9 kB

URL
news-xagedi.cc/lands/53/css/style.css
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (4928), with no line terminators
Size
4.9 kB (4928 bytes)
Hash
ff30963b59d24c95ee8ed06ee6f286d1
dbba4c06e6064e4bce5a928ff9905684d66a073d
d5ef0347241cb62969a80994ed4e4f87cf20f817e3036756df731aa04d238581

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/css/style.css HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:38 GMT
content-type: text/css
content-length: 4928
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-1340"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/lands/53/js/device.js

144.76.106.61

3.3 kB

URL
news-xagedi.cc/lands/53/js/device.js
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
ASCII text, with very long lines (3289), with no line terminators
Size
3.3 kB (3289 bytes)
Hash
2d9887b21aa6b47c56e7f43e66560a4f
42cdfc5b3b23d32152750bf2cea4233044491768
863a13c42ef72b562bc7aa5005b8ff5693763ae8d16ce3bfc3d876e92a7fdf85

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /lands/53/js/device.js HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUzLCJwMSI6InRrX2FkdWx0In0=
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:38 GMT
content-type: application/javascript; charset=utf-8
content-length: 3289
last-modified: Fri, 01 Dec 2023 12:50:34 GMT
etag: "6569d69a-cd9"
accept-ranges: bytes
X-Firefox-Spdy: h2

news-xagedi.cc/?id=1218770951&p1=tk_adult

144.76.106.61

80 kB

URL
news-xagedi.cc/?id=1218770951&p1=tk_adult
IP
144.76.106.61:0
ASN
#24940 Hetzner Online GmbH

File type
HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - HTML document text - exported SGML document text - exported SGML document, ASCII text, with very long lines (63930)
Size
80 kB (79868 bytes)
Hash
ba31d1e38845b2446a87760e50105037
753f8aca556f8ca8742d375294bbb42c873a5f9e
7c839cefab3c5657ef51439a80390f2740c7ad98a7f6fe3def4675b84f74bd9e

Detections

Analyzer	Verdict	Alert
Quad9 DNS	malicious	Sinkholed

HTTP Headers

GET /?id=1218770951&p1=tk_adult HTTP/1.1
Host: news-xagedi.cc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://news-xagedi.cc/?id=1218770951&p1=tk_adult
Cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjM3LCJwMSI6InRrX2FkdWx0In0=
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

HTTP/2 200 OK
server: nginx
date: Sun, 10 Dec 2023 09:08:34 GMT
content-type: text/html; charset=UTF-8
set-cookie: clickdata=eyJzdWJhY2MiOjEyMTg3NzA5NTEsImxhbmQiOjUwLCJwMSI6InRrX2FkdWx0In0=; Path=/; Expires=Mon, 11 Dec 2023 09:08:34 GMT; HttpOnly; Secure; SameSite=None
vary: Origin
X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (1)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

HTTP Transactions (248)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN